diff options
| author |   Daniel Borkmann <daniel@iogearbox.net> | 2015-07-17 22:38:44 +0200 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2015-07-21 00:25:03 -0700 |
| commit | ff3532f2655b79058fec035ca54fced69a483084 (patch) | |
| tree | 55fd69c3439be010605e609f6a892e7e3795608e | |
| parent | sched: cls_bpf: fix panic on filter replace (diff) | |
| download | linux-dev-ff3532f2655b79058fec035ca54fced69a483084.tar.xz linux-dev-ff3532f2655b79058fec035ca54fced69a483084.zip | |
sched: cls_flower: fix panic on filter replace
The following test case causes a NULL pointer dereference in cls_flower:
tc filter add dev foo parent 1: flower eth_type ipv4 action ok flowid 1:1
tc filter replace dev foo parent 1: pref 49152 handle 0x1 \
flower eth_type ipv6 action ok flowid 1:1
The problem is that commit 77b9900ef53a ("tc: introduce Flower classifier")
accidentally swapped the arguments of list_replace_rcu(), the old
element needs to be the first argument and the new element the second.
Fixes: 77b9900ef53a ("tc: introduce Flower classifier")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/sched/cls_flower.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index 9d37ccd95062..2f3d03f99487 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -499,7 +499,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, *arg = (unsigned long) fnew; if (fold) { - list_replace_rcu(&fnew->list, &fold->list); + list_replace_rcu(&fold->list, &fnew->list); tcf_unbind_filter(tp, &fold->res); call_rcu(&fold->rcu, fl_destroy_filter); } else { |